EVE Has Partially Predetermined Vault Key
Package
Affected versions
< 0.0.0-20220310190112-c0c966dc31e2
Patched versions
0.0.0-20220310190112-c0c966dc31e2
Description
Published to the GitHub Advisory Database
Feb 4, 2026
Reviewed
Feb 4, 2026
Last updated
Feb 4, 2026
Impact
The deriveVaultKey function calls retrieveCloudKey which always returns "foobarfoobarfoobarfoobarfoobarfo". When merged with the randomly generated 32-byte key using mergeKeys (16 bytes from each), the last 16 bytes are always "arfoobarfoobarfo". This enables an attacker with physical access to the EVE-OS device to attempt to brute force the remaining 128 bits of key.
Patches
Fixed in 7.10 and 8.12.1-lts
Workarounds
None
References